@conduction/nextcloud-vue 2.56.0-beta.3 → 2.56.0-beta.5

package/dist/esm/utils/linkNavigation.js.map

@@ -1 +1 @@
-{"version":3,"file":"linkNavigation.js","sources":["../../../src/utils/linkNavigation.js"],"sourcesContent":["/**\n * SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n *\n * linkNavigation — make navigation behave like a link.\n *\n * A control whose only job is to go somewhere should be a real `<a href>`, so\n * it can be middle-clicked, opened in a new tab and copied. Two helpers cover\n * the two shapes that needs:\n *\n *  - `followLinkClick` for a real `<a href>` that routes inside the app: a\n *    plain click goes through the router, any other click is left to the\n *    browser.\n *  - `openRowTarget` for a surface that cannot be an `<a>` (a table row, a\n *    draggable card): a plain click navigates in place, a ctrl/cmd/shift or\n *    middle click opens the target in a new tab. Bind it to both `@click` and\n *    `@auxclick`, since a middle click fires only the latter.\n *\n * A string target is a finished URL. Pass a router path as `{ path }` so the\n * router adds the app's base (`/index.php/apps/<app>`) to its href.\n *\n * @module utils/linkNavigation\n */\n\nimport { isFromNestedControl, isNewTabClick, isNewTabHandled, markNewTabHandled } from './rowAuxClick.js'\n\n/**\n * Whether the browser should handle this click itself (new tab, new window,\n * download) instead of the app navigating in place.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @return {boolean} True for a modifier key or a non-primary button.\n */\nexport function isModifiedClick(event) {\n\tif (!event) {\n\t\treturn false\n\t}\n\treturn Boolean(event.metaKey || event.ctrlKey || event.shiftKey || event.altKey\n\t\t|| (event.button !== undefined && event.button !== 0))\n}\n\n/**\n * The href for a navigation target. A string is returned as is, so a router\n * path must be passed as `{ path }` to get the app's base.\n *\n * @param {string|object|null|undefined} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {string} The href, or '' when it cannot be resolved.\n */\nexport function resolveHref(target, router) {\n\tif (!target) {\n\t\treturn ''\n\t}\n\tif (typeof target === 'string') {\n\t\treturn target\n\t}\n\tif (!router || typeof router.resolve !== 'function') {\n\t\treturn ''\n\t}\n\ttry {\n\t\treturn router.resolve(target).href || ''\n\t} catch {\n\t\treturn ''\n\t}\n}\n\n/**\n * Click handler for a real `<a href>` that routes inside the app. A plain\n * click is routed through the router; a modified click, or one a handler\n * already prevented, is left to the browser.\n *\n * @param {MouseEvent} event The click event.\n * @param {string|object} target The router location the link points at.\n * @param {object} [router] The app's router.\n * @return {boolean} True when the app navigated.\n */\nexport function followLinkClick(event, target, router) {\n\tif (!target || !router || typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\tif (event && (event.defaultPrevented || isModifiedClick(event))) {\n\t\treturn false\n\t}\n\tif (event) {\n\t\tevent.preventDefault()\n\t}\n\t// vue-router rejects the promise on a blocked or duplicate navigation.\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n\n/**\n * Navigate from a surface that cannot be an `<a>` (a table row, a card),\n * the way a link would: a ctrl/cmd/shift or middle click opens the target\n * in a new tab, a plain click navigates in place.\n *\n * A click that came from a control inside the surface (a button, a link, a\n * checkbox) is left to that control. Opening a new tab marks the event with\n * `preventDefault()`, and an event already marked that way is skipped, so\n * two listeners on the same click never open two tabs.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @param {string|object} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {boolean} True when it navigated.\n */\nexport function openRowTarget(event, target, router) {\n\tif (!target || isNewTabHandled(event) || isFromNestedControl(event)) {\n\t\treturn false\n\t}\n\tif (isNewTabClick(event)) {\n\t\tconst href = resolveHref(target, router)\n\t\tif (!href) {\n\t\t\treturn false\n\t\t}\n\t\twindow.open(href, '_blank', 'noopener,noreferrer')\n\t\tmarkNewTabHandled(event, true)\n\t\treturn true\n\t}\n\t// Only the primary button navigates in place; a right click opens the menu.\n\tif (event && event.button !== undefined && event.button !== 0) {\n\t\treturn false\n\t}\n\tif (typeof target === 'string') {\n\t\twindow.location.assign(target)\n\t\treturn true\n\t}\n\tif (!router || typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,CAAC,KAAK,EAAE;AACb,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM;AAChF,MAAM,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,CAAC,MAAM,EAAE;AACd,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,OAAO,MAAM;AACf,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE;AAC1C,EAAE,CAAC,MAAM;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACvD,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AAC9D,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,gBAAgB,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE;AAClE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;AACA,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACrD,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE;AACtE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC3B,EAAE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAC;AAC1C,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,OAAO,KAAK;AACf,GAAG;AACH,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAC;AACpD,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AAChE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AACnD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ;;;;"}
+{"version":3,"file":"linkNavigation.js","sources":["../../../src/utils/linkNavigation.js"],"sourcesContent":["/**\n * SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n *\n * linkNavigation — make navigation behave like a link.\n *\n * A control whose only job is to go somewhere should be a real `<a href>`, so\n * it can be middle-clicked, opened in a new tab and copied. Two helpers cover\n * the two shapes that needs:\n *\n *  - `followLinkClick` for a real `<a href>` that routes inside the app: a\n *    plain click goes through the router, any other click is left to the\n *    browser.\n *  - `openRowTarget` for a surface that cannot be an `<a>` (a table row, a\n *    draggable card): a plain click navigates in place, a ctrl/cmd/shift or\n *    middle click opens the target in a new tab. Bind it to both `@click` and\n *    `@auxclick`, since a middle click fires only the latter.\n *\n * A string target is a finished URL. Pass a router path as `{ path }` so the\n * router adds the app's base (`/index.php/apps/<app>`) to its href.\n *\n * @module utils/linkNavigation\n */\n\nimport { isFromNestedControl, isNewTabClick, isNewTabHandled, markNewTabHandled } from './rowAuxClick.js'\n\n/**\n * Whether the browser should handle this click itself (new tab, new window,\n * download) instead of the app navigating in place.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @return {boolean} True for a modifier key or a non-primary button.\n */\nexport function isModifiedClick(event) {\n\tif (!event) {\n\t\treturn false\n\t}\n\treturn Boolean(event.metaKey || event.ctrlKey || event.shiftKey || event.altKey\n\t\t|| (event.button !== undefined && event.button !== 0))\n}\n\n/**\n * The href for a navigation target. A string is returned as is, so a router\n * path must be passed as `{ path }` to get the app's base.\n *\n * @param {string|object|null|undefined} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {string} The href, or '' when it cannot be resolved.\n */\nexport function resolveHref(target, router) {\n\tif (!target) {\n\t\treturn ''\n\t}\n\tif (typeof target === 'string') {\n\t\treturn target\n\t}\n\tif (!router || typeof router.resolve !== 'function') {\n\t\treturn ''\n\t}\n\ttry {\n\t\treturn router.resolve(target).href || ''\n\t} catch {\n\t\treturn ''\n\t}\n}\n\n/**\n * Click handler for a real `<a href>` that routes inside the app. A plain\n * click is routed through the router; a modified click, or one a handler\n * already prevented, is left to the browser.\n *\n * Unlike `resolveHref`, a string target is a router path, so pair the two\n * with a location object (or `{ path }`) for the href and click to agree.\n *\n * @param {MouseEvent} event The click event.\n * @param {string|object} target The router location the link points at; a string is a router path.\n * @param {object} [router] The app's router.\n * @return {boolean} True when the app navigated.\n */\nexport function followLinkClick(event, target, router) {\n\tif (!target || !router || typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\tif (event && (event.defaultPrevented || isModifiedClick(event))) {\n\t\treturn false\n\t}\n\tif (event) {\n\t\tevent.preventDefault()\n\t}\n\t// vue-router rejects the promise on a blocked or duplicate navigation.\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n\n/**\n * Navigate from a surface that cannot be an `<a>` (a table row, a card),\n * the way a link would: a ctrl/cmd/shift or middle click opens the target\n * in a new tab, a plain click navigates in place.\n *\n * A click that came from a control inside the surface (a button, a link, a\n * checkbox) is left to that control. Opening a new tab marks the event with\n * `markNewTabHandled`, and an event already marked is skipped, so two\n * listeners on the same click never open two tabs.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @param {string|object} target A URL, or a vue-router location.\n * @param {object} [router] The app's router, needed for a location.\n * @return {boolean} True when it navigated.\n */\nexport function openRowTarget(event, target, router) {\n\tif (!target || isNewTabHandled(event) || isFromNestedControl(event)) {\n\t\treturn false\n\t}\n\tif (isNewTabClick(event)) {\n\t\tconst href = resolveHref(target, router)\n\t\tif (!href) {\n\t\t\treturn false\n\t\t}\n\t\twindow.open(href, '_blank', 'noopener,noreferrer')\n\t\tmarkNewTabHandled(event, true)\n\t\treturn true\n\t}\n\t// Only the primary button navigates in place; a right click opens the menu.\n\tif (event && event.button !== undefined && event.button !== 0) {\n\t\treturn false\n\t}\n\tif (typeof target === 'string') {\n\t\twindow.location.assign(target)\n\t\treturn true\n\t}\n\tif (!router || typeof router.push !== 'function') {\n\t\treturn false\n\t}\n\trouter.push(target).catch(() => {})\n\treturn true\n}\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,CAAC,KAAK,EAAE;AACb,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM;AAChF,MAAM,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,CAAC,MAAM,EAAE;AACd,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,OAAO,MAAM;AACf,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE;AAC1C,EAAE,CAAC,MAAM;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACvD,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AAC9D,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,gBAAgB,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE;AAClE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;AACA,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;AACrD,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE;AACtE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC3B,EAAE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAC;AAC1C,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,OAAO,KAAK;AACf,GAAG;AACH,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAC;AACpD,EAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AAChE,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACjC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAC;AAChC,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE;AACnD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC;AACpC,CAAC,OAAO,IAAI;AACZ;;;;"}

package/dist/esm/utils/rowAuxClick.js

@@ -9,13 +9,17 @@
  * also fire `auxclick` for the right button, so a row that listens to it must
  * filter both out itself.
  *
- * Whoever opens a row in a new tab calls `preventDefault()` on the event, so a
- * second listener for the same click (a host behind a library default) can
+ * Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so
+ * a second listener for the same click (a host behind a library default) can
  * check `isNewTabHandled` and not open a second tab.
  *
  * @module utils/rowAuxClick
  */
 
+// Events that opened a new tab. Not `defaultPrevented`, which any unrelated
+// handler can set on a modified or middle click.
+const newTabHandled = new WeakSet();
+
 const NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role="button"], [role="checkbox"], [role="link"], [contenteditable="true"]';
 
 /**
@@ -49,6 +53,21 @@ function isRowMiddleClick(event) {
 	return Boolean(event && event.button === 1 && !isFromNestedControl(event))
 }
 
+/**
+ * Cancel a middle-button press on a clickable row or card body, so the
+ * browser does not start autoscroll (Chrome/Edge on Windows) instead of the
+ * middle click opening the row. A press on a nested control, a link
+ * included, keeps its default.
+ *
+ * @param {MouseEvent} event The mousedown event.
+ * @return {void}
+ */
+function preventMiddleClickAutoscroll(event) {
+	if (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {
+		event.preventDefault();
+	}
+}
+
 /**
  * Whether `openRowTarget` would open this click in a new tab.
  *
@@ -66,21 +85,27 @@ function isNewTabClick(event) {
  * @return {boolean}
  */
 function isNewTabHandled(event) {
-	return Boolean(isNewTabClick(event) && event.defaultPrevented)
+	return Boolean(isNewTabClick(event) && newTabHandled.has(event))
 }
 
 /**
  * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.
+ * Also prevents the event's default, so the browser does not act on the
+ * click as well.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {boolean} opened Whether the target was opened.
  * @return {void}
  */
 function markNewTabHandled(event, opened) {
-	if (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {
+	if (!opened || !isNewTabClick(event)) {
+		return
+	}
+	newTabHandled.add(event);
+	if (typeof event.preventDefault === 'function') {
 		event.preventDefault();
 	}
 }
 
-export { isFromNestedControl, isNewTabClick, isNewTabHandled, isRowMiddleClick, markNewTabHandled };
+export { isFromNestedControl, isNewTabClick, isNewTabHandled, isRowMiddleClick, markNewTabHandled, preventMiddleClickAutoscroll };
 //# sourceMappingURL=rowAuxClick.js.map

package/dist/esm/utils/rowAuxClick.js.map

@@ -1 +1 @@
-{"version":3,"file":"rowAuxClick.js","sources":["../../../src/utils/rowAuxClick.js"],"sourcesContent":["/**\n * SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n *\n * rowAuxClick — decide whether an `auxclick` on a clickable row or card is a\n * middle click meant for the row itself.\n *\n * `@click.stop` on a nested control does not stop `auxclick`, and browsers\n * also fire `auxclick` for the right button, so a row that listens to it must\n * filter both out itself.\n *\n * Whoever opens a row in a new tab calls `preventDefault()` on the event, so a\n * second listener for the same click (a host behind a library default) can\n * check `isNewTabHandled` and not open a second tab.\n *\n * @module utils/rowAuxClick\n */\n\nconst NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role=\"button\"], [role=\"checkbox\"], [role=\"link\"], [contenteditable=\"true\"]'\n\n/**\n * Whether the event started on a control nested inside the element that\n * listens for it (not the listening element itself).\n *\n * @param {Event} event The click or auxclick event.\n * @return {boolean}\n */\nexport function isFromNestedControl(event) {\n\tconst target = event && event.target\n\tconst root = event && event.currentTarget\n\tif (!target || typeof target.closest !== 'function') {\n\t\treturn false\n\t}\n\tconst control = target.closest(NESTED_CONTROL)\n\tif (!control || control === root) {\n\t\treturn false\n\t}\n\treturn !root || typeof root.contains !== 'function' || root.contains(control)\n}\n\n/**\n * Whether an `auxclick` is a middle click on the row body, which should open\n * the row's target in a new tab.\n *\n * @param {MouseEvent} event The auxclick event.\n * @return {boolean}\n */\nexport function isRowMiddleClick(event) {\n\treturn Boolean(event && event.button === 1 && !isFromNestedControl(event))\n}\n\n/**\n * Whether `openRowTarget` would open this click in a new tab.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @return {boolean}\n */\nexport function isNewTabClick(event) {\n\treturn Boolean(event && (event.metaKey || event.ctrlKey || event.shiftKey || event.button === 1))\n}\n\n/**\n * Whether an earlier listener already opened this click in a new tab.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @return {boolean}\n */\nexport function isNewTabHandled(event) {\n\treturn Boolean(isNewTabClick(event) && event.defaultPrevented)\n}\n\n/**\n * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @param {boolean} opened Whether the target was opened.\n * @return {void}\n */\nexport function markNewTabHandled(event, opened) {\n\tif (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {\n\t\tevent.preventDefault()\n\t}\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,kIAAiI;AACxJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,mBAAmB,CAAC,KAAK,EAAE;AAC3C,CAAC,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,OAAM;AACrC,CAAC,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,cAAa;AAC1C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAC;AAC/C,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE;AACnC,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC9E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACxC,CAAC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE;AACrC,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC;AAC/D,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE;AACjD,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE;AACnF,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;;;;"}
+{"version":3,"file":"rowAuxClick.js","sources":["../../../src/utils/rowAuxClick.js"],"sourcesContent":["/**\n * SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n *\n * rowAuxClick — decide whether an `auxclick` on a clickable row or card is a\n * middle click meant for the row itself.\n *\n * `@click.stop` on a nested control does not stop `auxclick`, and browsers\n * also fire `auxclick` for the right button, so a row that listens to it must\n * filter both out itself.\n *\n * Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so\n * a second listener for the same click (a host behind a library default) can\n * check `isNewTabHandled` and not open a second tab.\n *\n * @module utils/rowAuxClick\n */\n\n// Events that opened a new tab. Not `defaultPrevented`, which any unrelated\n// handler can set on a modified or middle click.\nconst newTabHandled = new WeakSet()\n\nconst NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role=\"button\"], [role=\"checkbox\"], [role=\"link\"], [contenteditable=\"true\"]'\n\n/**\n * Whether the event started on a control nested inside the element that\n * listens for it (not the listening element itself).\n *\n * @param {Event} event The click or auxclick event.\n * @return {boolean}\n */\nexport function isFromNestedControl(event) {\n\tconst target = event && event.target\n\tconst root = event && event.currentTarget\n\tif (!target || typeof target.closest !== 'function') {\n\t\treturn false\n\t}\n\tconst control = target.closest(NESTED_CONTROL)\n\tif (!control || control === root) {\n\t\treturn false\n\t}\n\treturn !root || typeof root.contains !== 'function' || root.contains(control)\n}\n\n/**\n * Whether an `auxclick` is a middle click on the row body, which should open\n * the row's target in a new tab.\n *\n * @param {MouseEvent} event The auxclick event.\n * @return {boolean}\n */\nexport function isRowMiddleClick(event) {\n\treturn Boolean(event && event.button === 1 && !isFromNestedControl(event))\n}\n\n/**\n * Cancel a middle-button press on a clickable row or card body, so the\n * browser does not start autoscroll (Chrome/Edge on Windows) instead of the\n * middle click opening the row. A press on a nested control, a link\n * included, keeps its default.\n *\n * @param {MouseEvent} event The mousedown event.\n * @return {void}\n */\nexport function preventMiddleClickAutoscroll(event) {\n\tif (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {\n\t\tevent.preventDefault()\n\t}\n}\n\n/**\n * Whether `openRowTarget` would open this click in a new tab.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @return {boolean}\n */\nexport function isNewTabClick(event) {\n\treturn Boolean(event && (event.metaKey || event.ctrlKey || event.shiftKey || event.button === 1))\n}\n\n/**\n * Whether an earlier listener already opened this click in a new tab.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @return {boolean}\n */\nexport function isNewTabHandled(event) {\n\treturn Boolean(isNewTabClick(event) && newTabHandled.has(event))\n}\n\n/**\n * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.\n * Also prevents the event's default, so the browser does not act on the\n * click as well.\n *\n * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.\n * @param {boolean} opened Whether the target was opened.\n * @return {void}\n */\nexport function markNewTabHandled(event, opened) {\n\tif (!opened || !isNewTabClick(event)) {\n\t\treturn\n\t}\n\tnewTabHandled.add(event)\n\tif (typeof event.preventDefault === 'function') {\n\t\tevent.preventDefault()\n\t}\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,aAAa,GAAG,IAAI,OAAO,GAAE;AACnC;AACA,MAAM,cAAc,GAAG,kIAAiI;AACxJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,mBAAmB,CAAC,KAAK,EAAE;AAC3C,CAAC,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,OAAM;AACrC,CAAC,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,cAAa;AAC1C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;AACtD,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAC;AAC/C,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE;AACnC,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC9E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACxC,CAAC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,4BAA4B,CAAC,KAAK,EAAE;AACpD,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE;AAC/G,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,KAAK,EAAE;AACrC,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,KAAK,EAAE;AACvC,CAAC,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE;AACjD,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;AACvC,EAAE,MAAM;AACR,EAAE;AACF,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAC;AACzB,CAAC,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE;AACjD,EAAE,KAAK,CAAC,cAAc,GAAE;AACxB,EAAE;AACF;;;;"}

package/dist/esm/utils/safeHref.js

@@ -18,6 +18,20 @@
  * @module utils/safeHref
  */
 
+/**
+ * Whether a URL is protocol-relative the way a browser reads it: leading
+ * control characters and spaces are dropped, tabs and newlines are ignored
+ * anywhere, and a backslash counts as `/`.
+ *
+ * @param {string} url The URL.
+ * @return {boolean}
+ */
+function isProtocolRelative(url) {
+	// eslint-disable-next-line no-control-regex
+	const normalized = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '');
+	return /^[/\\]{2}/.test(normalized)
+}
+
 /**
  * Validate a URL and return it only if the scheme is safe for `:href`.
  *
@@ -30,7 +44,8 @@
  *   - `javascript:...`
  *   - `data:...`
  *   - `vbscript:...`
- *   - Protocol-relative `//attacker.com/...` (ambiguous origin)
+ *   - Protocol-relative `//attacker.com/...` (ambiguous origin), also as
+ *     `/\attacker.com` or with leading whitespace
  *   - Any other unrecognised scheme
  *   - `null`, `undefined`, empty string
  *
@@ -52,7 +67,7 @@ function safeHref(url) {
 	}
 	// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative
 	// path but resolves to an arbitrary origin, bypassing same-origin intent.
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return '#'
 	}
 	// Allow root-relative paths (same-origin navigation)
@@ -97,7 +112,7 @@ function safeImageSrc(url) {
 		return url
 	}
 	// Reject protocol-relative
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return ''
 	}
 	try {

package/dist/esm/utils/safeHref.js.map

@@ -1 +1 @@
-{"version":3,"file":"safeHref.js","sources":["../../../src/utils/safeHref.js"],"sourcesContent":["/**\n * SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n *\n * safeHref — URL scheme validation for `:href` bindings.\n *\n * Components that bind user-controlled URLs to `:href` attributes must\n * validate the scheme before rendering. Without this, a malicious data\n * source returning `javascript:alert(1)` or `data:text/html,...` as a\n * URL would execute code when the user clicks the link.\n *\n * This utility returns the original URL when the scheme is safe\n * (`https:`, `http:`, `mailto:`) or when the URL is a relative path\n * starting with `/`. It returns `'#'` for all other inputs including\n * `javascript:`, `data:`, `vbscript:`, protocol-relative (`//`), and any\n * other unrecognised scheme.\n *\n * @module utils/safeHref\n */\n\n/**\n * Validate a URL and return it only if the scheme is safe for `:href`.\n *\n * Safe inputs:\n *   - `https://...` and `http://...` absolute URLs\n *   - `mailto:...` links\n *   - Relative paths starting with `/` but NOT `//` (same-origin)\n *\n * Unsafe inputs (returns `'#'`):\n *   - `javascript:...`\n *   - `data:...`\n *   - `vbscript:...`\n *   - Protocol-relative `//attacker.com/...` (ambiguous origin)\n *   - Any other unrecognised scheme\n *   - `null`, `undefined`, empty string\n *\n * @param {string|null|undefined} url The URL to validate.\n * @return {string} The original URL if safe, or `'#'` otherwise.\n *\n * @example\n *   safeHref('https://example.com')        // -> 'https://example.com'\n *   safeHref('/apps/files')                // -> '/apps/files'\n *   safeHref('mailto:info@example.com')    // -> 'mailto:info@example.com'\n *   safeHref('javascript:alert(1)')        // -> '#'\n *   safeHref('data:text/html,<h1>x</h1>') // -> '#'\n *   safeHref('//attacker.com/x')           // -> '#'\n *   safeHref(null)                         // -> '#'\n */\nexport function safeHref(url) {\n\tif (!url || typeof url !== 'string') {\n\t\treturn '#'\n\t}\n\t// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative\n\t// path but resolves to an arbitrary origin, bypassing same-origin intent.\n\tif (url.startsWith('//')) {\n\t\treturn '#'\n\t}\n\t// Allow root-relative paths (same-origin navigation)\n\tif (url.startsWith('/')) {\n\t\treturn url\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:', 'mailto:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// URL constructor threw — not a valid absolute URL and not a\n\t\t// relative path either; treat as unsafe.\n\t}\n\treturn '#'\n}\n\n/**\n * Validate a URL for use in `src` attributes of `<img>` elements.\n *\n * Allows `https:`, `http:`, and safe `data:image/...` URIs for inline\n * images (PNG, JPEG, GIF, WebP). Rejects all other schemes including\n * `javascript:`, `data:text/html,...`, and protocol-relative URLs.\n *\n * @param {string|null|undefined} url The image URL to validate.\n * @return {string} The original URL if safe, or `''` otherwise.\n *\n * @example\n *   safeImageSrc('https://example.com/logo.png')            // -> 'https://...'\n *   safeImageSrc('data:image/png;base64,iVBOR...')          // -> 'data:image/...'\n *   safeImageSrc('data:text/html,<script>alert(1)</script>') // -> ''\n *   safeImageSrc('javascript:alert(1)')                      // -> ''\n *   safeImageSrc(null)                                        // -> ''\n */\nexport function safeImageSrc(url) {\n\tif (!url || typeof url !== 'string') {\n\t\treturn ''\n\t}\n\t// Allow safe inline image data URIs (png/jpeg/gif/webp only)\n\tif (/^data:image\\/(png|jpe?g|gif|webp);base64,/i.test(url)) {\n\t\treturn url\n\t}\n\t// Reject protocol-relative\n\tif (url.startsWith('//')) {\n\t\treturn ''\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// Not a valid URL — unsafe\n\t}\n\treturn ''\n}\n\n/**\n * SVG path `d` attribute allowlist validator.\n *\n * Restricts a path string to the characters used by SVG path commands:\n * letters (commands), digits, decimal points, commas, whitespace, and\n * the minus sign. Rejects any string containing other characters (e.g.\n * embedded script, unicode trickery).\n *\n * Returns the empty string for invalid inputs so a `:d` binding receives\n * an inert value rather than an attacker-controlled string.\n *\n * @param {string|null|undefined} pathData The SVG path `d` value.\n * @return {string} The original string if valid, or `''` otherwise.\n *\n * @example\n *   safeSvgPath('M12 2 L20 20 Z')  // -> 'M12 2 L20 20 Z'\n *   safeSvgPath('M0,0<script>')     // -> ''\n */\nexport function safeSvgPath(pathData) {\n\tif (!pathData || typeof pathData !== 'string') {\n\t\treturn ''\n\t}\n\t// Allowlist: SVG path command letters, digits, decimal points,\n\t// commas, whitespace, minus (for negative coordinates), and `e`/`E`\n\t// for scientific notation in arc radii.\n\tif (/^[MmLlHhVvCcSsQqTtAaZz0-9.,\\s\\-eE]+$/.test(pathData)) {\n\t\treturn pathData\n\t}\n\treturn ''\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,QAAQ,CAAC,GAAG,EAAE;AAC9B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA;AACA,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC1B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AAChE,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA;AACA,EAAE;AACF,CAAC,OAAO,GAAG;AACX,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAC,GAAG,EAAE;AAClC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC7D,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AACrD,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA,EAAE;AACF,CAAC,OAAO,EAAE;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,QAAQ,EAAE;AACtC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;AAChD,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA;AACA;AACA,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;AAC5D,EAAE,OAAO,QAAQ;AACjB,EAAE;AACF,CAAC,OAAO,EAAE;AACV;;;;"}
+{"version":3,"file":"safeHref.js","sources":["../../../src/utils/safeHref.js"],"sourcesContent":["/**\n * SPDX-License-Identifier: EUPL-1.2\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n *\n * safeHref — URL scheme validation for `:href` bindings.\n *\n * Components that bind user-controlled URLs to `:href` attributes must\n * validate the scheme before rendering. Without this, a malicious data\n * source returning `javascript:alert(1)` or `data:text/html,...` as a\n * URL would execute code when the user clicks the link.\n *\n * This utility returns the original URL when the scheme is safe\n * (`https:`, `http:`, `mailto:`) or when the URL is a relative path\n * starting with `/`. It returns `'#'` for all other inputs including\n * `javascript:`, `data:`, `vbscript:`, protocol-relative (`//`), and any\n * other unrecognised scheme.\n *\n * @module utils/safeHref\n */\n\n/**\n * Whether a URL is protocol-relative the way a browser reads it: leading\n * control characters and spaces are dropped, tabs and newlines are ignored\n * anywhere, and a backslash counts as `/`.\n *\n * @param {string} url The URL.\n * @return {boolean}\n */\nfunction isProtocolRelative(url) {\n\t// eslint-disable-next-line no-control-regex\n\tconst normalized = url.replace(/[\\t\\n\\r]/g, '').replace(/^[\\u0000-\\u0020]+/, '')\n\treturn /^[/\\\\]{2}/.test(normalized)\n}\n\n/**\n * Validate a URL and return it only if the scheme is safe for `:href`.\n *\n * Safe inputs:\n *   - `https://...` and `http://...` absolute URLs\n *   - `mailto:...` links\n *   - Relative paths starting with `/` but NOT `//` (same-origin)\n *\n * Unsafe inputs (returns `'#'`):\n *   - `javascript:...`\n *   - `data:...`\n *   - `vbscript:...`\n *   - Protocol-relative `//attacker.com/...` (ambiguous origin), also as\n *     `/\\attacker.com` or with leading whitespace\n *   - Any other unrecognised scheme\n *   - `null`, `undefined`, empty string\n *\n * @param {string|null|undefined} url The URL to validate.\n * @return {string} The original URL if safe, or `'#'` otherwise.\n *\n * @example\n *   safeHref('https://example.com')        // -> 'https://example.com'\n *   safeHref('/apps/files')                // -> '/apps/files'\n *   safeHref('mailto:info@example.com')    // -> 'mailto:info@example.com'\n *   safeHref('javascript:alert(1)')        // -> '#'\n *   safeHref('data:text/html,<h1>x</h1>') // -> '#'\n *   safeHref('//attacker.com/x')           // -> '#'\n *   safeHref(null)                         // -> '#'\n */\nexport function safeHref(url) {\n\tif (!url || typeof url !== 'string') {\n\t\treturn '#'\n\t}\n\t// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative\n\t// path but resolves to an arbitrary origin, bypassing same-origin intent.\n\tif (isProtocolRelative(url)) {\n\t\treturn '#'\n\t}\n\t// Allow root-relative paths (same-origin navigation)\n\tif (url.startsWith('/')) {\n\t\treturn url\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:', 'mailto:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// URL constructor threw — not a valid absolute URL and not a\n\t\t// relative path either; treat as unsafe.\n\t}\n\treturn '#'\n}\n\n/**\n * Validate a URL for use in `src` attributes of `<img>` elements.\n *\n * Allows `https:`, `http:`, and safe `data:image/...` URIs for inline\n * images (PNG, JPEG, GIF, WebP). Rejects all other schemes including\n * `javascript:`, `data:text/html,...`, and protocol-relative URLs.\n *\n * @param {string|null|undefined} url The image URL to validate.\n * @return {string} The original URL if safe, or `''` otherwise.\n *\n * @example\n *   safeImageSrc('https://example.com/logo.png')            // -> 'https://...'\n *   safeImageSrc('data:image/png;base64,iVBOR...')          // -> 'data:image/...'\n *   safeImageSrc('data:text/html,<script>alert(1)</script>') // -> ''\n *   safeImageSrc('javascript:alert(1)')                      // -> ''\n *   safeImageSrc(null)                                        // -> ''\n */\nexport function safeImageSrc(url) {\n\tif (!url || typeof url !== 'string') {\n\t\treturn ''\n\t}\n\t// Allow safe inline image data URIs (png/jpeg/gif/webp only)\n\tif (/^data:image\\/(png|jpe?g|gif|webp);base64,/i.test(url)) {\n\t\treturn url\n\t}\n\t// Reject protocol-relative\n\tif (isProtocolRelative(url)) {\n\t\treturn ''\n\t}\n\ttry {\n\t\tconst parsed = new URL(url, window.location.origin)\n\t\tif (['https:', 'http:'].includes(parsed.protocol)) {\n\t\t\treturn url\n\t\t}\n\t} catch {\n\t\t// Not a valid URL — unsafe\n\t}\n\treturn ''\n}\n\n/**\n * SVG path `d` attribute allowlist validator.\n *\n * Restricts a path string to the characters used by SVG path commands:\n * letters (commands), digits, decimal points, commas, whitespace, and\n * the minus sign. Rejects any string containing other characters (e.g.\n * embedded script, unicode trickery).\n *\n * Returns the empty string for invalid inputs so a `:d` binding receives\n * an inert value rather than an attacker-controlled string.\n *\n * @param {string|null|undefined} pathData The SVG path `d` value.\n * @return {string} The original string if valid, or `''` otherwise.\n *\n * @example\n *   safeSvgPath('M12 2 L20 20 Z')  // -> 'M12 2 L20 20 Z'\n *   safeSvgPath('M0,0<script>')     // -> ''\n */\nexport function safeSvgPath(pathData) {\n\tif (!pathData || typeof pathData !== 'string') {\n\t\treturn ''\n\t}\n\t// Allowlist: SVG path command letters, digits, decimal points,\n\t// commas, whitespace, minus (for negative coordinates), and `e`/`E`\n\t// for scientific notation in arc radii.\n\tif (/^[MmLlHhVvCcSsQqTtAaZz0-9.,\\s\\-eE]+$/.test(pathData)) {\n\t\treturn pathData\n\t}\n\treturn ''\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC;AACA,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAC;AACjF,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;AACpC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,QAAQ,CAAC,GAAG,EAAE;AAC9B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA;AACA,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE;AAC9B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC1B,EAAE,OAAO,GAAG;AACZ,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AAChE,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA;AACA,EAAE;AACF,CAAC,OAAO,GAAG;AACX,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAC,GAAG,EAAE;AAClC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AACtC,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC7D,EAAE,OAAO,GAAG;AACZ,EAAE;AACF;AACA,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE;AAC9B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAC;AACrD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AACrD,GAAG,OAAO,GAAG;AACb,GAAG;AACH,EAAE,CAAC,MAAM;AACT;AACA,EAAE;AACF,CAAC,OAAO,EAAE;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAC,QAAQ,EAAE;AACtC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;AAChD,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA;AACA;AACA,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;AAC5D,EAAE,OAAO,QAAQ;AACjB,EAAE;AACF,CAAC,OAAO,EAAE;AACV;;;;"}